Legal support for AI, data, software and regulated sectors

The AI Act – Regulation (EU) 2024/1689, the EU Artificial Intelligence Act – covers both organisations that develop AI systems (providers) and those that use them (deployers). The scope of your obligations depends on that role and on the system’s risk category. The starting point is to determine your organisation’s role and classify the system.

Yes, if you use them in a professional capacity. When you use an off-the-shelf AI tool, you usually act as a deployer rather than a provider – your obligations are then narrower and depend on what you use the tool for and in what context. Even for simple uses, you need to ensure an adequate level of AI literacy within your team, and high-risk uses – such as recruitment or employee assessment – bring further requirements. The picture changes if you modify the tool, integrate it into your own product or make it available under your own brand – you may then take on the obligations of a provider.

The AI Act classifies systems by the risk associated with their intended purpose and use, not by the technology itself. An AI system is classified as high-risk if it is a product, or a safety component of a product, covered by specific EU legislation and required to undergo third-party conformity assessment, or if it is used in one of the areas listed in the AI Act, such as biometrics, critical infrastructure, education, employment or access to certain essential services. For the second category, the AI Act provides limited exceptions where the system does not pose a significant risk of harm and meets additional conditions set out in the Regulation. These exceptions do not apply to systems that perform profiling of natural persons.

It depends on the type of data, the purpose for which it was collected and the legal basis for processing it. If the dataset contains personal data, using it to train an AI model must comply with the GDPR, in particular the principles of purpose limitation and data minimisation. Using data for a new purpose may require an assessment of whether that purpose is compatible with the original one.

The Polish National Cybersecurity System Act (KSC Act), amended to implement the NIS2 Directive, divides entities into essential and important entities. An entity required to apply for entry in the list must do so within 6 months of meeting the criteria, and must implement the obligations set out in Chapter 3 of the Act – including an information security management system – within 12 months. The first step is to determine whether your organisation is covered by the Act and, if so, whether as an essential or an important entity.

DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, applicable since 17 January 2025 – sets requirements for contracts between financial entities and ICT third-party service providers. Every such contract must include specific provisions, among others on the locations where services are provided and data is processed, security and data protection, assistance in the event of ICT incidents, and termination rights. Contracts for ICT services supporting critical or important functions are subject to additional requirements, including access, inspection and audit rights and exit strategies. DORA’s requirements also apply to contracts concluded before 17 January 2025.

Under Polish law, as a rule, no. Only an employer acquires the economic rights by operation of law, and only to a computer program created by an employee in the course of their duties. Where the work is done under a civil-law contract, including a B2B contract, the rights remain with the author until they are transferred by a contract made in writing or in electronic form (with a qualified electronic signature) that specifies the fields of exploitation, i.e. the specific ways in which the work may be used. Placing the order and paying the fee are not enough. That is why securing the chain of title, including with respect to subcontractors, is particularly important before a transaction or investment.

The AI Act does not apply to AI systems placed on the market, put into service or used exclusively for military, defence or national security purposes – regardless of whether this is done by a public or a private entity. What matters, however, is the purpose, not the type of system. An AI system intended both for such purposes and for others – for example civilian or law enforcement – is covered by the AI Act. The same applies to a military system that starts to be used for other purposes.

SAFE (Security Action for Europe) is an EU instrument providing Member States with up to EUR 150 billion in loans for joint defence procurement in 2025–2030. For technology companies and their suppliers, it means growing demand, but also requirements concerning, among other things, the contractor’s place of establishment and control, and the origin of components. We advise on how to prepare for such projects from a contractual and regulatory perspective.